{"level":"info","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe"}
{"level":"debug","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe"}
{"level":"debug","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-03T14:49:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-03T14:49:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-03T14:49:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-03T14:49:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe"}
{"level":"debug","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe"}
{"level":"debug","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-03T14:49:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-03T14:49:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-03T14:49:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-03T14:49:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe"}
{"level":"debug","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe"}
{"level":"debug","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-03T14:49:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-03T14:49:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-03T14:49:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-03T14:49:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe"}
{"level":"debug","ts":"2026-07-03T14:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe"}
{"level":"debug","ts":"2026-07-03T14:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-03T14:49:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-03T14:49:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-03T14:49:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-03T14:49:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe"}
{"level":"debug","ts":"2026-07-03T14:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe"}
{"level":"debug","ts":"2026-07-03T14:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-03T14:49:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-03T14:49:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-03T14:49:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-03T14:49:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe"}
{"level":"debug","ts":"2026-07-03T14:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe"}
{"level":"debug","ts":"2026-07-03T14:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-03T14:49:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-03T14:49:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe"}
{"level":"debug","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fae6878d457b6289f8d706d2031988169fdd437c70955859c223174df0f3c979","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fae6878d457b6289f8d706d2031988169fdd437c70955859c223174df0f3c979"}
{"level":"debug","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-03T14:50:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-03T14:50:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb"}
{"level":"debug","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb"}
{"level":"debug","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-03T14:50:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-03T14:50:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-03T14:50:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-03T14:50:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0c98039502d78adfbda0e8012d4940b0ca3257544f8aa3d72e823c1b590eaece","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb"}
{"level":"debug","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-03T14:50:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-03T14:50:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0c98039502d78adfbda0e8012d4940b0ca3257544f8aa3d72e823c1b590eaece"}
{"level":"info","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-03T14:50:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-03T14:50:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb"}
{"level":"info","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb"}
{"level":"debug","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb"}
{"level":"debug","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-03T14:50:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-03T14:50:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb"}
{"level":"debug","ts":"2026-07-03T14:50:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd4f243ffc7dbb58e04c6983ec796ab49558a11d0755bf22db2df66ec336c07a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-03T14:50:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-03T14:50:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd4f243ffc7dbb58e04c6983ec796ab49558a11d0755bf22db2df66ec336c07a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd4f243ffc7dbb58e04c6983ec796ab49558a11d0755bf22db2df66ec336c07a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd4f243ffc7dbb58e04c6983ec796ab49558a11d0755bf22db2df66ec336c07a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd4f243ffc7dbb58e04c6983ec796ab49558a11d0755bf22db2df66ec336c07a"}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd4f243ffc7dbb58e04c6983ec796ab49558a11d0755bf22db2df66ec336c07a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd4f243ffc7dbb58e04c6983ec796ab49558a11d0755bf22db2df66ec336c07a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd4f243ffc7dbb58e04c6983ec796ab49558a11d0755bf22db2df66ec336c07a"}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ea71400b4948ca776489731482d56adc440d326f468ad9cfd3f92c4910a641e2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ea71400b4948ca776489731482d56adc440d326f468ad9cfd3f92c4910a641e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ea71400b4948ca776489731482d56adc440d326f468ad9cfd3f92c4910a641e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ea71400b4948ca776489731482d56adc440d326f468ad9cfd3f92c4910a641e2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ea71400b4948ca776489731482d56adc440d326f468ad9cfd3f92c4910a641e2"}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ea71400b4948ca776489731482d56adc440d326f468ad9cfd3f92c4910a641e2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ea71400b4948ca776489731482d56adc440d326f468ad9cfd3f92c4910a641e2"}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd4f243ffc7dbb58e04c6983ec796ab49558a11d0755bf22db2df66ec336c07a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cd4f243ffc7dbb58e04c6983ec796ab49558a11d0755bf22db2df66ec336c07a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd4f243ffc7dbb58e04c6983ec796ab49558a11d0755bf22db2df66ec336c07a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ea71400b4948ca776489731482d56adc440d326f468ad9cfd3f92c4910a641e2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ea71400b4948ca776489731482d56adc440d326f468ad9cfd3f92c4910a641e2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ea71400b4948ca776489731482d56adc440d326f468ad9cfd3f92c4910a641e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd4f243ffc7dbb58e04c6983ec796ab49558a11d0755bf22db2df66ec336c07a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd4f243ffc7dbb58e04c6983ec796ab49558a11d0755bf22db2df66ec336c07a"}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd4f243ffc7dbb58e04c6983ec796ab49558a11d0755bf22db2df66ec336c07a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d76cf2f0756dcc9cb91fbae467d60ce4402ac8feadbd9092e310afa799791a00","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d76cf2f0756dcc9cb91fbae467d60ce4402ac8feadbd9092e310afa799791a00","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ea71400b4948ca776489731482d56adc440d326f468ad9cfd3f92c4910a641e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"15b54feaa3283b591d6954a4c2e498f308b468789829c0d93c654070e3e53c07","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd4f243ffc7dbb58e04c6983ec796ab49558a11d0755bf22db2df66ec336c07a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cd4f243ffc7dbb58e04c6983ec796ab49558a11d0755bf22db2df66ec336c07a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d76cf2f0756dcc9cb91fbae467d60ce4402ac8feadbd9092e310afa799791a00"}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd4f243ffc7dbb58e04c6983ec796ab49558a11d0755bf22db2df66ec336c07a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d76cf2f0756dcc9cb91fbae467d60ce4402ac8feadbd9092e310afa799791a00","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d76cf2f0756dcc9cb91fbae467d60ce4402ac8feadbd9092e310afa799791a00"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ea71400b4948ca776489731482d56adc440d326f468ad9cfd3f92c4910a641e2"}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d76cf2f0756dcc9cb91fbae467d60ce4402ac8feadbd9092e310afa799791a00","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd4f243ffc7dbb58e04c6983ec796ab49558a11d0755bf22db2df66ec336c07a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d76cf2f0756dcc9cb91fbae467d60ce4402ac8feadbd9092e310afa799791a00","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/15b54feaa3283b591d6954a4c2e498f308b468789829c0d93c654070e3e53c07"}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd4f243ffc7dbb58e04c6983ec796ab49558a11d0755bf22db2df66ec336c07a"}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d76cf2f0756dcc9cb91fbae467d60ce4402ac8feadbd9092e310afa799791a00"}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"203181f7301d734b850333610db2593513f38583d99cd3af768fb99984e85fbd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"203181f7301d734b850333610db2593513f38583d99cd3af768fb99984e85fbd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"203181f7301d734b850333610db2593513f38583d99cd3af768fb99984e85fbd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"203181f7301d734b850333610db2593513f38583d99cd3af768fb99984e85fbd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/203181f7301d734b850333610db2593513f38583d99cd3af768fb99984e85fbd"}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"203181f7301d734b850333610db2593513f38583d99cd3af768fb99984e85fbd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/203181f7301d734b850333610db2593513f38583d99cd3af768fb99984e85fbd"}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"203181f7301d734b850333610db2593513f38583d99cd3af768fb99984e85fbd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["203181f7301d734b850333610db2593513f38583d99cd3af768fb99984e85fbd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"203181f7301d734b850333610db2593513f38583d99cd3af768fb99984e85fbd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"203181f7301d734b850333610db2593513f38583d99cd3af768fb99984e85fbd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"771af810728e3343d423e7dd0e7f672e8091321060d5c93741f8d2b63a1dc2ca","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/203181f7301d734b850333610db2593513f38583d99cd3af768fb99984e85fbd"}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/771af810728e3343d423e7dd0e7f672e8091321060d5c93741f8d2b63a1dc2ca"}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0fd8d72267f80a3490f09e2b7edd5614c945a877e3430a25f075206e96823ede","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0fd8d72267f80a3490f09e2b7edd5614c945a877e3430a25f075206e96823ede","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0fd8d72267f80a3490f09e2b7edd5614c945a877e3430a25f075206e96823ede","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0fd8d72267f80a3490f09e2b7edd5614c945a877e3430a25f075206e96823ede"}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0fd8d72267f80a3490f09e2b7edd5614c945a877e3430a25f075206e96823ede","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0fd8d72267f80a3490f09e2b7edd5614c945a877e3430a25f075206e96823ede"}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0fd8d72267f80a3490f09e2b7edd5614c945a877e3430a25f075206e96823ede","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0fd8d72267f80a3490f09e2b7edd5614c945a877e3430a25f075206e96823ede"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0fd8d72267f80a3490f09e2b7edd5614c945a877e3430a25f075206e96823ede","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0fd8d72267f80a3490f09e2b7edd5614c945a877e3430a25f075206e96823ede","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0fd8d72267f80a3490f09e2b7edd5614c945a877e3430a25f075206e96823ede"}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b5e25a53111a6a6306192c36e709e8fe981522c10ba51529dbe74dca96d436c6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b5e25a53111a6a6306192c36e709e8fe981522c10ba51529dbe74dca96d436c6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b5e25a53111a6a6306192c36e709e8fe981522c10ba51529dbe74dca96d436c6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b5e25a53111a6a6306192c36e709e8fe981522c10ba51529dbe74dca96d436c6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b5e25a53111a6a6306192c36e709e8fe981522c10ba51529dbe74dca96d436c6"}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b5e25a53111a6a6306192c36e709e8fe981522c10ba51529dbe74dca96d436c6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b5e25a53111a6a6306192c36e709e8fe981522c10ba51529dbe74dca96d436c6"}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b5e25a53111a6a6306192c36e709e8fe981522c10ba51529dbe74dca96d436c6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-03T14:50:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b5e25a53111a6a6306192c36e709e8fe981522c10ba51529dbe74dca96d436c6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b5e25a53111a6a6306192c36e709e8fe981522c10ba51529dbe74dca96d436c6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b5e25a53111a6a6306192c36e709e8fe981522c10ba51529dbe74dca96d436c6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6da687a9423cb1cd83f9369b18c567cc07f2740dc9f3cb687b027f113a78f8f8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b5e25a53111a6a6306192c36e709e8fe981522c10ba51529dbe74dca96d436c6"}
{"level":"info","ts":"2026-07-03T14:50:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6da687a9423cb1cd83f9369b18c567cc07f2740dc9f3cb687b027f113a78f8f8"}
{"level":"debug","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-03T14:50:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-03T14:50:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937"}
{"level":"debug","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ccf844f57fd8314eca4a040bd8ebc2be525ed88f246425d5ca2b8cb8dc10e0b5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-03T14:50:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-03T14:50:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe"}
{"level":"info","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-03T14:50:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-03T14:50:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937"}
{"level":"info","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-03T14:50:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-03T14:50:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-03T14:50:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-03T14:50:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccf844f57fd8314eca4a040bd8ebc2be525ed88f246425d5ca2b8cb8dc10e0b5"}
{"level":"error","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-03T14:50:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-03T14:50:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"053727ff9bfc97d33969508ff3039b50a215303fd2ecadc2f94858f9009aa0fa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-03T14:50:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-03T14:50:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937"}
{"level":"error","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e6b2297f9471e2f5b885ee1a891990a3479ae3ae777d0c7a5114e9bf8281a7fb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-03T14:50:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-03T14:50:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5b99b2c497c3817255fbcf023aaeeeddbece345da53b037e0ff53b9ed8331fbd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-03T14:50:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-03T14:50:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/053727ff9bfc97d33969508ff3039b50a215303fd2ecadc2f94858f9009aa0fa"}
{"level":"error","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e6b2297f9471e2f5b885ee1a891990a3479ae3ae777d0c7a5114e9bf8281a7fb"}
{"level":"info","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937"}
{"level":"debug","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4597c544e325ad79b33b73db7dbc249f06348e877aff727e229453210130b14d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5b99b2c497c3817255fbcf023aaeeeddbece345da53b037e0ff53b9ed8331fbd"}
{"level":"debug","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0185a7089d7aa5db387ce8e5b1d4e6dafff3ed1df0afc5d209c9ece82d8ff4a2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4597c544e325ad79b33b73db7dbc249f06348e877aff727e229453210130b14d"}
{"level":"debug","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1da4a770c0278faeee21afbf1390ce8d6b36de8cd36d2619b950abf305036cc6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0185a7089d7aa5db387ce8e5b1d4e6dafff3ed1df0afc5d209c9ece82d8ff4a2"}
{"level":"debug","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b31e033c2769b31b04fb6af32e382ca1c8ba8d9ffac1104d3bfdb4176a0586a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6db2aadf746eb80c2bbd0e0030d907451b51db9d2506c1028c9ab972e6b0b245","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1da4a770c0278faeee21afbf1390ce8d6b36de8cd36d2619b950abf305036cc6"}
{"level":"info","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b31e033c2769b31b04fb6af32e382ca1c8ba8d9ffac1104d3bfdb4176a0586a7"}
{"level":"debug","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2b3d5ce24ab33eeea1b018d17fa24507338dc96f0fd2385383b8f4cacc9b2046","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6db2aadf746eb80c2bbd0e0030d907451b51db9d2506c1028c9ab972e6b0b245"}
{"level":"info","ts":"2026-07-03T14:50:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2b3d5ce24ab33eeea1b018d17fa24507338dc96f0fd2385383b8f4cacc9b2046"}
{"level":"info","ts":"2026-07-03T14:50:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bccc5ddf-9ee9-4faa-aa02-632ebda54a40","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:36212","PortSpecifier":{"PortValue":36212}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bccc5ddf-9ee9-4faa-aa02-632ebda54a40","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-03T14:50:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bccc5ddf-9ee9-4faa-aa02-632ebda54a40","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:36212","PortSpecifier":{"PortValue":36212}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783090206,"nanos":987406966},"http":{"id":"bccc5ddf-9ee9-4faa-aa02-632ebda54a40","method":"POST","headers":{":authority":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:06Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"bccc5ddf-9ee9-4faa-aa02-632ebda54a40","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-03T14:50:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bccc5ddf-9ee9-4faa-aa02-632ebda54a40","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"e3557cb2-c45d-4a17-8b58-56268ef857be","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=f1b27e2e-e407-4abb-bb8d-735671e4aaf8"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/8fa024d471b6"]}}
{"level":"debug","ts":"2026-07-03T14:50:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bccc5ddf-9ee9-4faa-aa02-632ebda54a40","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/8fa024d471b6"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=f1b27e2e-e407-4abb-bb8d-735671e4aaf8"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"e3557cb2-c45d-4a17-8b58-56268ef857be","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"0fd8d72267f80a3490f09e2b7edd5614c945a877e3430a25f075206e96823ede"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.58:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bccc5ddf-9ee9-4faa-aa02-632ebda54a40","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bccc5ddf-9ee9-4faa-aa02-632ebda54a40","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bccc5ddf-9ee9-4faa-aa02-632ebda54a40","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"bccc5ddf-9ee9-4faa-aa02-632ebda54a40","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-03T14:50:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bccc5ddf-9ee9-4faa-aa02-632ebda54a40","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-03T14:50:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bccc5ddf-9ee9-4faa-aa02-632ebda54a40","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-03T14:50:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bccc5ddf-9ee9-4faa-aa02-632ebda54a40","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-03T14:50:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bccc5ddf-9ee9-4faa-aa02-632ebda54a40","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b241182f-6a49-4d72-b3f6-fdb0b3159096","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:50152","PortSpecifier":{"PortValue":50152}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b241182f-6a49-4d72-b3f6-fdb0b3159096","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-28686a.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b241182f-6a49-4d72-b3f6-fdb0b3159096","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:50152","PortSpecifier":{"PortValue":50152}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783090207,"nanos":38662916},"http":{"id":"b241182f-6a49-4d72-b3f6-fdb0b3159096","method":"POST","headers":{":authority":"e2e-shared-b-28686a.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b241182f-6a49-4d72-b3f6-fdb0b3159096","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b241182f-6a49-4d72-b3f6-fdb0b3159096","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"e3557cb2-c45d-4a17-8b58-56268ef857be","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=f1b27e2e-e407-4abb-bb8d-735671e4aaf8"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/8fa024d471b6"]}}
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b241182f-6a49-4d72-b3f6-fdb0b3159096","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/8fa024d471b6"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=f1b27e2e-e407-4abb-bb8d-735671e4aaf8"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"e3557cb2-c45d-4a17-8b58-56268ef857be","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d76cf2f0756dcc9cb91fbae467d60ce4402ac8feadbd9092e310afa799791a00"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.59:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-28686a.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b241182f-6a49-4d72-b3f6-fdb0b3159096","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b241182f-6a49-4d72-b3f6-fdb0b3159096","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b241182f-6a49-4d72-b3f6-fdb0b3159096","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-28686a/rate-test-model-28686a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b241182f-6a49-4d72-b3f6-fdb0b3159096","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b241182f-6a49-4d72-b3f6-fdb0b3159096","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b241182f-6a49-4d72-b3f6-fdb0b3159096","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b241182f-6a49-4d72-b3f6-fdb0b3159096","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b241182f-6a49-4d72-b3f6-fdb0b3159096","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"50426591-9b4a-40c9-910d-077034d6401f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:36220","PortSpecifier":{"PortValue":36220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"50426591-9b4a-40c9-910d-077034d6401f","method":"POST","path":"/ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04/v1/completions","host":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"50426591-9b4a-40c9-910d-077034d6401f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:36220","PortSpecifier":{"PortValue":36220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783090207,"nanos":90709746},"http":{"id":"50426591-9b4a-40c9-910d-077034d6401f","method":"POST","headers":{":authority":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"50426591-9b4a-40c9-910d-077034d6401f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1L0wQgBAxhIOOQZwc_JAhn2IQT2CfdOt7QwOjjy3PhW7hW7RNo8qArEhyNue4"}
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"50426591-9b4a-40c9-910d-077034d6401f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1L0wQgBAxhIOOQZwc_JAhn2IQT2CfdOt7QwOjjy3PhW7hW7RNo8qArEhyNue4\"}"}
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"50426591-9b4a-40c9-910d-077034d6401f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ada42e89-dbaf-4671-a48c-516b2dd15abe","keyName":"e2e-rate-a-b45b7a","subscription":"e2e-rate-iso-a-b45b7a","tenant":"e2e-shared-a-5f1e04","userId":"ada42e89-dbaf-4671-a48c-516b2dd15abe","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"50426591-9b4a-40c9-910d-077034d6401f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04\",\"requestedSubscription\":\"e2e-rate-iso-a-b45b7a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"50426591-9b4a-40c9-910d-077034d6401f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5f1e04","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b45b7a","namespace":"ai-tenant-e2e-shared-a-5f1e04","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"50426591-9b4a-40c9-910d-077034d6401f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"50426591-9b4a-40c9-910d-077034d6401f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"50426591-9b4a-40c9-910d-077034d6401f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"50426591-9b4a-40c9-910d-077034d6401f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"50426591-9b4a-40c9-910d-077034d6401f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"50426591-9b4a-40c9-910d-077034d6401f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"50426591-9b4a-40c9-910d-077034d6401f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"50426591-9b4a-40c9-910d-077034d6401f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b45b7a"}
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"50426591-9b4a-40c9-910d-077034d6401f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ada42e89-dbaf-4671-a48c-516b2dd15abe","keyName":"e2e-rate-a-b45b7a","selected_subscription":"e2e-rate-iso-a-b45b7a","selected_subscription_key":"ai-tenant-e2e-shared-a-5f1e04/e2e-rate-iso-a-b45b7a@ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5f1e04","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b45b7a","namespace":"ai-tenant-e2e-shared-a-5f1e04","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"50426591-9b4a-40c9-910d-077034d6401f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-03T14:50:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"50426591-9b4a-40c9-910d-077034d6401f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-03T14:50:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2dc22fa0-3bcd-4061-88fd-d0ce88284276","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:59492","PortSpecifier":{"PortValue":59492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2dc22fa0-3bcd-4061-88fd-d0ce88284276","method":"POST","path":"/ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04/v1/completions","host":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-03T14:50:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2dc22fa0-3bcd-4061-88fd-d0ce88284276","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:59492","PortSpecifier":{"PortValue":59492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783090208,"nanos":155938162},"http":{"id":"2dc22fa0-3bcd-4061-88fd-d0ce88284276","method":"POST","headers":{":authority":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2dc22fa0-3bcd-4061-88fd-d0ce88284276","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1L0wQgBAxhIOOQZwc_JAhn2IQT2CfdOt7QwOjjy3PhW7hW7RNo8qArEhyNue4"}
{"level":"debug","ts":"2026-07-03T14:50:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2dc22fa0-3bcd-4061-88fd-d0ce88284276","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1L0wQgBAxhIOOQZwc_JAhn2IQT2CfdOt7QwOjjy3PhW7hW7RNo8qArEhyNue4\"}"}
{"level":"debug","ts":"2026-07-03T14:50:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2dc22fa0-3bcd-4061-88fd-d0ce88284276","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ada42e89-dbaf-4671-a48c-516b2dd15abe","keyName":"e2e-rate-a-b45b7a","subscription":"e2e-rate-iso-a-b45b7a","tenant":"e2e-shared-a-5f1e04","userId":"ada42e89-dbaf-4671-a48c-516b2dd15abe","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-03T14:50:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2dc22fa0-3bcd-4061-88fd-d0ce88284276","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04\",\"requestedSubscription\":\"e2e-rate-iso-a-b45b7a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-03T14:50:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2dc22fa0-3bcd-4061-88fd-d0ce88284276","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5f1e04","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b45b7a","namespace":"ai-tenant-e2e-shared-a-5f1e04","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-03T14:50:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2dc22fa0-3bcd-4061-88fd-d0ce88284276","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2dc22fa0-3bcd-4061-88fd-d0ce88284276","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2dc22fa0-3bcd-4061-88fd-d0ce88284276","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2dc22fa0-3bcd-4061-88fd-d0ce88284276","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2dc22fa0-3bcd-4061-88fd-d0ce88284276","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2dc22fa0-3bcd-4061-88fd-d0ce88284276","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b45b7a"}
{"level":"debug","ts":"2026-07-03T14:50:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2dc22fa0-3bcd-4061-88fd-d0ce88284276","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-03T14:50:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2dc22fa0-3bcd-4061-88fd-d0ce88284276","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-03T14:50:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2dc22fa0-3bcd-4061-88fd-d0ce88284276","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ada42e89-dbaf-4671-a48c-516b2dd15abe","keyName":"e2e-rate-a-b45b7a","selected_subscription":"e2e-rate-iso-a-b45b7a","selected_subscription_key":"ai-tenant-e2e-shared-a-5f1e04/e2e-rate-iso-a-b45b7a@ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5f1e04","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b45b7a","namespace":"ai-tenant-e2e-shared-a-5f1e04","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-03T14:50:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2dc22fa0-3bcd-4061-88fd-d0ce88284276","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-03T14:50:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2dc22fa0-3bcd-4061-88fd-d0ce88284276","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-03T14:50:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"acaa4402-664f-4828-8353-0e556c536ecb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:59502","PortSpecifier":{"PortValue":59502}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"acaa4402-664f-4828-8353-0e556c536ecb","method":"POST","path":"/ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04/v1/completions","host":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-03T14:50:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"acaa4402-664f-4828-8353-0e556c536ecb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:59502","PortSpecifier":{"PortValue":59502}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783090209,"nanos":194625933},"http":{"id":"acaa4402-664f-4828-8353-0e556c536ecb","method":"POST","headers":{":authority":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"acaa4402-664f-4828-8353-0e556c536ecb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1L0wQgBAxhIOOQZwc_JAhn2IQT2CfdOt7QwOjjy3PhW7hW7RNo8qArEhyNue4"}
{"level":"debug","ts":"2026-07-03T14:50:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"acaa4402-664f-4828-8353-0e556c536ecb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1L0wQgBAxhIOOQZwc_JAhn2IQT2CfdOt7QwOjjy3PhW7hW7RNo8qArEhyNue4\"}"}
{"level":"debug","ts":"2026-07-03T14:50:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"acaa4402-664f-4828-8353-0e556c536ecb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ada42e89-dbaf-4671-a48c-516b2dd15abe","keyName":"e2e-rate-a-b45b7a","subscription":"e2e-rate-iso-a-b45b7a","tenant":"e2e-shared-a-5f1e04","userId":"ada42e89-dbaf-4671-a48c-516b2dd15abe","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-03T14:50:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"acaa4402-664f-4828-8353-0e556c536ecb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04\",\"requestedSubscription\":\"e2e-rate-iso-a-b45b7a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-03T14:50:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"acaa4402-664f-4828-8353-0e556c536ecb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5f1e04","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b45b7a","namespace":"ai-tenant-e2e-shared-a-5f1e04","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-03T14:50:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"acaa4402-664f-4828-8353-0e556c536ecb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"acaa4402-664f-4828-8353-0e556c536ecb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"acaa4402-664f-4828-8353-0e556c536ecb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"acaa4402-664f-4828-8353-0e556c536ecb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"acaa4402-664f-4828-8353-0e556c536ecb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"acaa4402-664f-4828-8353-0e556c536ecb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-03T14:50:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"acaa4402-664f-4828-8353-0e556c536ecb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b45b7a"}
{"level":"debug","ts":"2026-07-03T14:50:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"acaa4402-664f-4828-8353-0e556c536ecb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-03T14:50:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"acaa4402-664f-4828-8353-0e556c536ecb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ada42e89-dbaf-4671-a48c-516b2dd15abe","keyName":"e2e-rate-a-b45b7a","selected_subscription":"e2e-rate-iso-a-b45b7a","selected_subscription_key":"ai-tenant-e2e-shared-a-5f1e04/e2e-rate-iso-a-b45b7a@ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5f1e04","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b45b7a","namespace":"ai-tenant-e2e-shared-a-5f1e04","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-03T14:50:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"acaa4402-664f-4828-8353-0e556c536ecb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-03T14:50:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"acaa4402-664f-4828-8353-0e556c536ecb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8967d680-8a77-4cac-9447-e48fb6993df4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:47436","PortSpecifier":{"PortValue":47436}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8967d680-8a77-4cac-9447-e48fb6993df4","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8967d680-8a77-4cac-9447-e48fb6993df4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:47436","PortSpecifier":{"PortValue":47436}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783090217,"nanos":817336843},"http":{"id":"8967d680-8a77-4cac-9447-e48fb6993df4","method":"POST","headers":{":authority":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8967d680-8a77-4cac-9447-e48fb6993df4","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8967d680-8a77-4cac-9447-e48fb6993df4","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"e3557cb2-c45d-4a17-8b58-56268ef857be","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=f1b27e2e-e407-4abb-bb8d-735671e4aaf8"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/8fa024d471b6"]}}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8967d680-8a77-4cac-9447-e48fb6993df4","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/8fa024d471b6"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=f1b27e2e-e407-4abb-bb8d-735671e4aaf8"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"e3557cb2-c45d-4a17-8b58-56268ef857be","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"0fd8d72267f80a3490f09e2b7edd5614c945a877e3430a25f075206e96823ede"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.58:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8967d680-8a77-4cac-9447-e48fb6993df4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8967d680-8a77-4cac-9447-e48fb6993df4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8967d680-8a77-4cac-9447-e48fb6993df4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8967d680-8a77-4cac-9447-e48fb6993df4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8967d680-8a77-4cac-9447-e48fb6993df4","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8967d680-8a77-4cac-9447-e48fb6993df4","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8967d680-8a77-4cac-9447-e48fb6993df4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8967d680-8a77-4cac-9447-e48fb6993df4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c1237857-7dd0-491e-9a1b-f15d56fd82de","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:55410","PortSpecifier":{"PortValue":55410}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c1237857-7dd0-491e-9a1b-f15d56fd82de","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-28686a.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c1237857-7dd0-491e-9a1b-f15d56fd82de","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:55410","PortSpecifier":{"PortValue":55410}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783090217,"nanos":856188269},"http":{"id":"c1237857-7dd0-491e-9a1b-f15d56fd82de","method":"POST","headers":{":authority":"e2e-shared-b-28686a.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c1237857-7dd0-491e-9a1b-f15d56fd82de","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c1237857-7dd0-491e-9a1b-f15d56fd82de","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"e3557cb2-c45d-4a17-8b58-56268ef857be","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=f1b27e2e-e407-4abb-bb8d-735671e4aaf8"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/8fa024d471b6"]}}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c1237857-7dd0-491e-9a1b-f15d56fd82de","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/8fa024d471b6"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=f1b27e2e-e407-4abb-bb8d-735671e4aaf8"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"e3557cb2-c45d-4a17-8b58-56268ef857be","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d76cf2f0756dcc9cb91fbae467d60ce4402ac8feadbd9092e310afa799791a00"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.59:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-28686a.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c1237857-7dd0-491e-9a1b-f15d56fd82de","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c1237857-7dd0-491e-9a1b-f15d56fd82de","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c1237857-7dd0-491e-9a1b-f15d56fd82de","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-28686a/rate-test-model-28686a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c1237857-7dd0-491e-9a1b-f15d56fd82de","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c1237857-7dd0-491e-9a1b-f15d56fd82de","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c1237857-7dd0-491e-9a1b-f15d56fd82de","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c1237857-7dd0-491e-9a1b-f15d56fd82de","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c1237857-7dd0-491e-9a1b-f15d56fd82de","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"71e3482c-577e-4338-b00e-9b25b10a8315","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:47438","PortSpecifier":{"PortValue":47438}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"71e3482c-577e-4338-b00e-9b25b10a8315","method":"POST","path":"/ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04/v1/completions","host":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"71e3482c-577e-4338-b00e-9b25b10a8315","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:47438","PortSpecifier":{"PortValue":47438}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783090217,"nanos":894702485},"http":{"id":"71e3482c-577e-4338-b00e-9b25b10a8315","method":"POST","headers":{":authority":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"71e3482c-577e-4338-b00e-9b25b10a8315","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1XOqEvQkLDU3n2uL3_V822yFc2rI3JHZWugIIFrHMfHgg8J4HIRE4cy0lTQWM"}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"71e3482c-577e-4338-b00e-9b25b10a8315","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1XOqEvQkLDU3n2uL3_V822yFc2rI3JHZWugIIFrHMfHgg8J4HIRE4cy0lTQWM\"}"}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"71e3482c-577e-4338-b00e-9b25b10a8315","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b0202491-447f-48d2-98ff-1ec15e3bf3e0","keyName":"e2e-rate-a-64afed","subscription":"e2e-rate-iso-a-64afed","tenant":"e2e-shared-a-5f1e04","userId":"b0202491-447f-48d2-98ff-1ec15e3bf3e0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"71e3482c-577e-4338-b00e-9b25b10a8315","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04\",\"requestedSubscription\":\"e2e-rate-iso-a-64afed\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"71e3482c-577e-4338-b00e-9b25b10a8315","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5f1e04","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64afed","namespace":"ai-tenant-e2e-shared-a-5f1e04","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"71e3482c-577e-4338-b00e-9b25b10a8315","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71e3482c-577e-4338-b00e-9b25b10a8315","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71e3482c-577e-4338-b00e-9b25b10a8315","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71e3482c-577e-4338-b00e-9b25b10a8315","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71e3482c-577e-4338-b00e-9b25b10a8315","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71e3482c-577e-4338-b00e-9b25b10a8315","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71e3482c-577e-4338-b00e-9b25b10a8315","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71e3482c-577e-4338-b00e-9b25b10a8315","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-64afed"}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71e3482c-577e-4338-b00e-9b25b10a8315","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b0202491-447f-48d2-98ff-1ec15e3bf3e0","keyName":"e2e-rate-a-64afed","selected_subscription":"e2e-rate-iso-a-64afed","selected_subscription_key":"ai-tenant-e2e-shared-a-5f1e04/e2e-rate-iso-a-64afed@ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5f1e04","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64afed","namespace":"ai-tenant-e2e-shared-a-5f1e04","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"71e3482c-577e-4338-b00e-9b25b10a8315","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-03T14:50:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"71e3482c-577e-4338-b00e-9b25b10a8315","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-03T14:50:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2b0f8c28-cdbd-45a0-8c03-21488377dd18","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:47452","PortSpecifier":{"PortValue":47452}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2b0f8c28-cdbd-45a0-8c03-21488377dd18","method":"POST","path":"/ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04/v1/completions","host":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-03T14:50:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2b0f8c28-cdbd-45a0-8c03-21488377dd18","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:47452","PortSpecifier":{"PortValue":47452}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783090218,"nanos":929359913},"http":{"id":"2b0f8c28-cdbd-45a0-8c03-21488377dd18","method":"POST","headers":{":authority":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2b0f8c28-cdbd-45a0-8c03-21488377dd18","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1XOqEvQkLDU3n2uL3_V822yFc2rI3JHZWugIIFrHMfHgg8J4HIRE4cy0lTQWM"}
{"level":"debug","ts":"2026-07-03T14:50:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2b0f8c28-cdbd-45a0-8c03-21488377dd18","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1XOqEvQkLDU3n2uL3_V822yFc2rI3JHZWugIIFrHMfHgg8J4HIRE4cy0lTQWM\"}"}
{"level":"debug","ts":"2026-07-03T14:50:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2b0f8c28-cdbd-45a0-8c03-21488377dd18","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b0202491-447f-48d2-98ff-1ec15e3bf3e0","keyName":"e2e-rate-a-64afed","subscription":"e2e-rate-iso-a-64afed","tenant":"e2e-shared-a-5f1e04","userId":"b0202491-447f-48d2-98ff-1ec15e3bf3e0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-03T14:50:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2b0f8c28-cdbd-45a0-8c03-21488377dd18","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04\",\"requestedSubscription\":\"e2e-rate-iso-a-64afed\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-03T14:50:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2b0f8c28-cdbd-45a0-8c03-21488377dd18","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5f1e04","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64afed","namespace":"ai-tenant-e2e-shared-a-5f1e04","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-03T14:50:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2b0f8c28-cdbd-45a0-8c03-21488377dd18","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b0f8c28-cdbd-45a0-8c03-21488377dd18","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b0f8c28-cdbd-45a0-8c03-21488377dd18","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b0f8c28-cdbd-45a0-8c03-21488377dd18","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b0f8c28-cdbd-45a0-8c03-21488377dd18","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b0f8c28-cdbd-45a0-8c03-21488377dd18","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-03T14:50:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b0f8c28-cdbd-45a0-8c03-21488377dd18","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-64afed"}
{"level":"debug","ts":"2026-07-03T14:50:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b0f8c28-cdbd-45a0-8c03-21488377dd18","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-03T14:50:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b0f8c28-cdbd-45a0-8c03-21488377dd18","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b0202491-447f-48d2-98ff-1ec15e3bf3e0","keyName":"e2e-rate-a-64afed","selected_subscription":"e2e-rate-iso-a-64afed","selected_subscription_key":"ai-tenant-e2e-shared-a-5f1e04/e2e-rate-iso-a-64afed@ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5f1e04","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64afed","namespace":"ai-tenant-e2e-shared-a-5f1e04","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-03T14:50:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2b0f8c28-cdbd-45a0-8c03-21488377dd18","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-03T14:50:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2b0f8c28-cdbd-45a0-8c03-21488377dd18","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-03T14:50:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c3b25657-eab7-45f2-b82e-16a6564a9b23","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:47458","PortSpecifier":{"PortValue":47458}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c3b25657-eab7-45f2-b82e-16a6564a9b23","method":"POST","path":"/ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04/v1/completions","host":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-03T14:50:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c3b25657-eab7-45f2-b82e-16a6564a9b23","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:47458","PortSpecifier":{"PortValue":47458}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783090219,"nanos":964761184},"http":{"id":"c3b25657-eab7-45f2-b82e-16a6564a9b23","method":"POST","headers":{":authority":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:19Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c3b25657-eab7-45f2-b82e-16a6564a9b23","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1XOqEvQkLDU3n2uL3_V822yFc2rI3JHZWugIIFrHMfHgg8J4HIRE4cy0lTQWM"}
{"level":"debug","ts":"2026-07-03T14:50:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c3b25657-eab7-45f2-b82e-16a6564a9b23","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1XOqEvQkLDU3n2uL3_V822yFc2rI3JHZWugIIFrHMfHgg8J4HIRE4cy0lTQWM\"}"}
{"level":"debug","ts":"2026-07-03T14:50:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c3b25657-eab7-45f2-b82e-16a6564a9b23","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b0202491-447f-48d2-98ff-1ec15e3bf3e0","keyName":"e2e-rate-a-64afed","subscription":"e2e-rate-iso-a-64afed","tenant":"e2e-shared-a-5f1e04","userId":"b0202491-447f-48d2-98ff-1ec15e3bf3e0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-03T14:50:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c3b25657-eab7-45f2-b82e-16a6564a9b23","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04\",\"requestedSubscription\":\"e2e-rate-iso-a-64afed\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-03T14:50:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c3b25657-eab7-45f2-b82e-16a6564a9b23","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5f1e04","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64afed","namespace":"ai-tenant-e2e-shared-a-5f1e04","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-03T14:50:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c3b25657-eab7-45f2-b82e-16a6564a9b23","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c3b25657-eab7-45f2-b82e-16a6564a9b23","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c3b25657-eab7-45f2-b82e-16a6564a9b23","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c3b25657-eab7-45f2-b82e-16a6564a9b23","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c3b25657-eab7-45f2-b82e-16a6564a9b23","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c3b25657-eab7-45f2-b82e-16a6564a9b23","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-64afed"}
{"level":"debug","ts":"2026-07-03T14:50:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c3b25657-eab7-45f2-b82e-16a6564a9b23","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-03T14:50:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c3b25657-eab7-45f2-b82e-16a6564a9b23","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-03T14:50:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c3b25657-eab7-45f2-b82e-16a6564a9b23","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b0202491-447f-48d2-98ff-1ec15e3bf3e0","keyName":"e2e-rate-a-64afed","selected_subscription":"e2e-rate-iso-a-64afed","selected_subscription_key":"ai-tenant-e2e-shared-a-5f1e04/e2e-rate-iso-a-64afed@ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5f1e04","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64afed","namespace":"ai-tenant-e2e-shared-a-5f1e04","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-03T14:50:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c3b25657-eab7-45f2-b82e-16a6564a9b23","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-03T14:50:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c3b25657-eab7-45f2-b82e-16a6564a9b23","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-03T14:50:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"96da4621-c224-4865-aae7-433e99528598","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:47472","PortSpecifier":{"PortValue":47472}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"96da4621-c224-4865-aae7-433e99528598","method":"POST","path":"/ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04/v1/completions","host":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-03T14:50:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"96da4621-c224-4865-aae7-433e99528598","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:47472","PortSpecifier":{"PortValue":47472}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783090221,"nanos":2709185},"http":{"id":"96da4621-c224-4865-aae7-433e99528598","method":"POST","headers":{":authority":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:21Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"96da4621-c224-4865-aae7-433e99528598","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1XOqEvQkLDU3n2uL3_V822yFc2rI3JHZWugIIFrHMfHgg8J4HIRE4cy0lTQWM"}
{"level":"debug","ts":"2026-07-03T14:50:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"96da4621-c224-4865-aae7-433e99528598","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1XOqEvQkLDU3n2uL3_V822yFc2rI3JHZWugIIFrHMfHgg8J4HIRE4cy0lTQWM\"}"}
{"level":"debug","ts":"2026-07-03T14:50:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"96da4621-c224-4865-aae7-433e99528598","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b0202491-447f-48d2-98ff-1ec15e3bf3e0","keyName":"e2e-rate-a-64afed","subscription":"e2e-rate-iso-a-64afed","tenant":"e2e-shared-a-5f1e04","userId":"b0202491-447f-48d2-98ff-1ec15e3bf3e0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-03T14:50:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"96da4621-c224-4865-aae7-433e99528598","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04\",\"requestedSubscription\":\"e2e-rate-iso-a-64afed\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-03T14:50:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"96da4621-c224-4865-aae7-433e99528598","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5f1e04","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64afed","namespace":"ai-tenant-e2e-shared-a-5f1e04","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-03T14:50:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"96da4621-c224-4865-aae7-433e99528598","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96da4621-c224-4865-aae7-433e99528598","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96da4621-c224-4865-aae7-433e99528598","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96da4621-c224-4865-aae7-433e99528598","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96da4621-c224-4865-aae7-433e99528598","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96da4621-c224-4865-aae7-433e99528598","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-03T14:50:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96da4621-c224-4865-aae7-433e99528598","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-64afed"}
{"level":"debug","ts":"2026-07-03T14:50:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96da4621-c224-4865-aae7-433e99528598","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-03T14:50:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96da4621-c224-4865-aae7-433e99528598","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b0202491-447f-48d2-98ff-1ec15e3bf3e0","keyName":"e2e-rate-a-64afed","selected_subscription":"e2e-rate-iso-a-64afed","selected_subscription_key":"ai-tenant-e2e-shared-a-5f1e04/e2e-rate-iso-a-64afed@ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5f1e04","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64afed","namespace":"ai-tenant-e2e-shared-a-5f1e04","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-03T14:50:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"96da4621-c224-4865-aae7-433e99528598","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-03T14:50:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"96da4621-c224-4865-aae7-433e99528598","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-03T14:50:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"02618cea-ba98-4abd-ae2b-1cfb93d53f7f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:47476","PortSpecifier":{"PortValue":47476}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"02618cea-ba98-4abd-ae2b-1cfb93d53f7f","method":"POST","path":"/ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04/v1/completions","host":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-03T14:50:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"02618cea-ba98-4abd-ae2b-1cfb93d53f7f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:47476","PortSpecifier":{"PortValue":47476}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783090222,"nanos":41429183},"http":{"id":"02618cea-ba98-4abd-ae2b-1cfb93d53f7f","method":"POST","headers":{":authority":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"02618cea-ba98-4abd-ae2b-1cfb93d53f7f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1XOqEvQkLDU3n2uL3_V822yFc2rI3JHZWugIIFrHMfHgg8J4HIRE4cy0lTQWM"}
{"level":"debug","ts":"2026-07-03T14:50:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"02618cea-ba98-4abd-ae2b-1cfb93d53f7f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1XOqEvQkLDU3n2uL3_V822yFc2rI3JHZWugIIFrHMfHgg8J4HIRE4cy0lTQWM\"}"}
{"level":"debug","ts":"2026-07-03T14:50:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"02618cea-ba98-4abd-ae2b-1cfb93d53f7f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b0202491-447f-48d2-98ff-1ec15e3bf3e0","keyName":"e2e-rate-a-64afed","subscription":"e2e-rate-iso-a-64afed","tenant":"e2e-shared-a-5f1e04","userId":"b0202491-447f-48d2-98ff-1ec15e3bf3e0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-03T14:50:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"02618cea-ba98-4abd-ae2b-1cfb93d53f7f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04\",\"requestedSubscription\":\"e2e-rate-iso-a-64afed\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-03T14:50:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"02618cea-ba98-4abd-ae2b-1cfb93d53f7f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5f1e04","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64afed","namespace":"ai-tenant-e2e-shared-a-5f1e04","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-03T14:50:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"02618cea-ba98-4abd-ae2b-1cfb93d53f7f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02618cea-ba98-4abd-ae2b-1cfb93d53f7f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02618cea-ba98-4abd-ae2b-1cfb93d53f7f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02618cea-ba98-4abd-ae2b-1cfb93d53f7f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02618cea-ba98-4abd-ae2b-1cfb93d53f7f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02618cea-ba98-4abd-ae2b-1cfb93d53f7f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-03T14:50:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02618cea-ba98-4abd-ae2b-1cfb93d53f7f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-64afed"}
{"level":"debug","ts":"2026-07-03T14:50:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02618cea-ba98-4abd-ae2b-1cfb93d53f7f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-03T14:50:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02618cea-ba98-4abd-ae2b-1cfb93d53f7f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b0202491-447f-48d2-98ff-1ec15e3bf3e0","keyName":"e2e-rate-a-64afed","selected_subscription":"e2e-rate-iso-a-64afed","selected_subscription_key":"ai-tenant-e2e-shared-a-5f1e04/e2e-rate-iso-a-64afed@ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5f1e04","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64afed","namespace":"ai-tenant-e2e-shared-a-5f1e04","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-03T14:50:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"02618cea-ba98-4abd-ae2b-1cfb93d53f7f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-03T14:50:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"02618cea-ba98-4abd-ae2b-1cfb93d53f7f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-03T14:50:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"840b8d48-b5f0-4569-bd32-05dd34f6630f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:47482","PortSpecifier":{"PortValue":47482}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"840b8d48-b5f0-4569-bd32-05dd34f6630f","method":"POST","path":"/ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04/v1/completions","host":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-03T14:50:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"840b8d48-b5f0-4569-bd32-05dd34f6630f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:47482","PortSpecifier":{"PortValue":47482}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783090223,"nanos":76897325},"http":{"id":"840b8d48-b5f0-4569-bd32-05dd34f6630f","method":"POST","headers":{":authority":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"840b8d48-b5f0-4569-bd32-05dd34f6630f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1XOqEvQkLDU3n2uL3_V822yFc2rI3JHZWugIIFrHMfHgg8J4HIRE4cy0lTQWM"}
{"level":"debug","ts":"2026-07-03T14:50:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"840b8d48-b5f0-4569-bd32-05dd34f6630f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1XOqEvQkLDU3n2uL3_V822yFc2rI3JHZWugIIFrHMfHgg8J4HIRE4cy0lTQWM\"}"}
{"level":"debug","ts":"2026-07-03T14:50:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"840b8d48-b5f0-4569-bd32-05dd34f6630f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b0202491-447f-48d2-98ff-1ec15e3bf3e0","keyName":"e2e-rate-a-64afed","subscription":"e2e-rate-iso-a-64afed","tenant":"e2e-shared-a-5f1e04","userId":"b0202491-447f-48d2-98ff-1ec15e3bf3e0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-03T14:50:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"840b8d48-b5f0-4569-bd32-05dd34f6630f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04\",\"requestedSubscription\":\"e2e-rate-iso-a-64afed\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-03T14:50:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"840b8d48-b5f0-4569-bd32-05dd34f6630f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5f1e04","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64afed","namespace":"ai-tenant-e2e-shared-a-5f1e04","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-03T14:50:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"840b8d48-b5f0-4569-bd32-05dd34f6630f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"840b8d48-b5f0-4569-bd32-05dd34f6630f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"840b8d48-b5f0-4569-bd32-05dd34f6630f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"840b8d48-b5f0-4569-bd32-05dd34f6630f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"840b8d48-b5f0-4569-bd32-05dd34f6630f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"840b8d48-b5f0-4569-bd32-05dd34f6630f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-03T14:50:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"840b8d48-b5f0-4569-bd32-05dd34f6630f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-64afed"}
{"level":"debug","ts":"2026-07-03T14:50:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"840b8d48-b5f0-4569-bd32-05dd34f6630f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-03T14:50:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"840b8d48-b5f0-4569-bd32-05dd34f6630f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b0202491-447f-48d2-98ff-1ec15e3bf3e0","keyName":"e2e-rate-a-64afed","selected_subscription":"e2e-rate-iso-a-64afed","selected_subscription_key":"ai-tenant-e2e-shared-a-5f1e04/e2e-rate-iso-a-64afed@ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5f1e04","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64afed","namespace":"ai-tenant-e2e-shared-a-5f1e04","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-03T14:50:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"840b8d48-b5f0-4569-bd32-05dd34f6630f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-03T14:50:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"840b8d48-b5f0-4569-bd32-05dd34f6630f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-03T14:50:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3728e1af-f45f-4db9-a3e2-ca4b9e146629","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:47490","PortSpecifier":{"PortValue":47490}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3728e1af-f45f-4db9-a3e2-ca4b9e146629","method":"POST","path":"/ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04/v1/completions","host":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-03T14:50:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3728e1af-f45f-4db9-a3e2-ca4b9e146629","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:47490","PortSpecifier":{"PortValue":47490}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783090224,"nanos":113888227},"http":{"id":"3728e1af-f45f-4db9-a3e2-ca4b9e146629","method":"POST","headers":{":authority":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3728e1af-f45f-4db9-a3e2-ca4b9e146629","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1XOqEvQkLDU3n2uL3_V822yFc2rI3JHZWugIIFrHMfHgg8J4HIRE4cy0lTQWM"}
{"level":"debug","ts":"2026-07-03T14:50:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3728e1af-f45f-4db9-a3e2-ca4b9e146629","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1XOqEvQkLDU3n2uL3_V822yFc2rI3JHZWugIIFrHMfHgg8J4HIRE4cy0lTQWM\"}"}
{"level":"debug","ts":"2026-07-03T14:50:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3728e1af-f45f-4db9-a3e2-ca4b9e146629","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b0202491-447f-48d2-98ff-1ec15e3bf3e0","keyName":"e2e-rate-a-64afed","subscription":"e2e-rate-iso-a-64afed","tenant":"e2e-shared-a-5f1e04","userId":"b0202491-447f-48d2-98ff-1ec15e3bf3e0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-03T14:50:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3728e1af-f45f-4db9-a3e2-ca4b9e146629","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04\",\"requestedSubscription\":\"e2e-rate-iso-a-64afed\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-03T14:50:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3728e1af-f45f-4db9-a3e2-ca4b9e146629","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5f1e04","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64afed","namespace":"ai-tenant-e2e-shared-a-5f1e04","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-03T14:50:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3728e1af-f45f-4db9-a3e2-ca4b9e146629","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3728e1af-f45f-4db9-a3e2-ca4b9e146629","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3728e1af-f45f-4db9-a3e2-ca4b9e146629","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3728e1af-f45f-4db9-a3e2-ca4b9e146629","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3728e1af-f45f-4db9-a3e2-ca4b9e146629","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3728e1af-f45f-4db9-a3e2-ca4b9e146629","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-03T14:50:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3728e1af-f45f-4db9-a3e2-ca4b9e146629","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-03T14:50:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3728e1af-f45f-4db9-a3e2-ca4b9e146629","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-64afed"}
{"level":"debug","ts":"2026-07-03T14:50:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3728e1af-f45f-4db9-a3e2-ca4b9e146629","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b0202491-447f-48d2-98ff-1ec15e3bf3e0","keyName":"e2e-rate-a-64afed","selected_subscription":"e2e-rate-iso-a-64afed","selected_subscription_key":"ai-tenant-e2e-shared-a-5f1e04/e2e-rate-iso-a-64afed@ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5f1e04","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64afed","namespace":"ai-tenant-e2e-shared-a-5f1e04","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-03T14:50:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3728e1af-f45f-4db9-a3e2-ca4b9e146629","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-03T14:50:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3728e1af-f45f-4db9-a3e2-ca4b9e146629","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"50fc5c51-90c9-4dd1-b4f0-57706bbf2fa1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:47498","PortSpecifier":{"PortValue":47498}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"50fc5c51-90c9-4dd1-b4f0-57706bbf2fa1","method":"POST","path":"/ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04/v1/completions","host":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"50fc5c51-90c9-4dd1-b4f0-57706bbf2fa1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:47498","PortSpecifier":{"PortValue":47498}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783090225,"nanos":154257652},"http":{"id":"50fc5c51-90c9-4dd1-b4f0-57706bbf2fa1","method":"POST","headers":{":authority":"e2e-shared-a-5f1e04.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"50fc5c51-90c9-4dd1-b4f0-57706bbf2fa1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1XOqEvQkLDU3n2uL3_V822yFc2rI3JHZWugIIFrHMfHgg8J4HIRE4cy0lTQWM"}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"50fc5c51-90c9-4dd1-b4f0-57706bbf2fa1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1XOqEvQkLDU3n2uL3_V822yFc2rI3JHZWugIIFrHMfHgg8J4HIRE4cy0lTQWM\"}"}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"50fc5c51-90c9-4dd1-b4f0-57706bbf2fa1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b0202491-447f-48d2-98ff-1ec15e3bf3e0","keyName":"e2e-rate-a-64afed","subscription":"e2e-rate-iso-a-64afed","tenant":"e2e-shared-a-5f1e04","userId":"b0202491-447f-48d2-98ff-1ec15e3bf3e0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"50fc5c51-90c9-4dd1-b4f0-57706bbf2fa1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04\",\"requestedSubscription\":\"e2e-rate-iso-a-64afed\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"50fc5c51-90c9-4dd1-b4f0-57706bbf2fa1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5f1e04.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5f1e04","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64afed","namespace":"ai-tenant-e2e-shared-a-5f1e04","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"50fc5c51-90c9-4dd1-b4f0-57706bbf2fa1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"50fc5c51-90c9-4dd1-b4f0-57706bbf2fa1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"50fc5c51-90c9-4dd1-b4f0-57706bbf2fa1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"50fc5c51-90c9-4dd1-b4f0-57706bbf2fa1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"50fc5c51-90c9-4dd1-b4f0-57706bbf2fa1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"50fc5c51-90c9-4dd1-b4f0-57706bbf2fa1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"50fc5c51-90c9-4dd1-b4f0-57706bbf2fa1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"50fc5c51-90c9-4dd1-b4f0-57706bbf2fa1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-64afed"}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"50fc5c51-90c9-4dd1-b4f0-57706bbf2fa1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b0202491-447f-48d2-98ff-1ec15e3bf3e0","keyName":"e2e-rate-a-64afed","selected_subscription":"e2e-rate-iso-a-64afed","selected_subscription_key":"ai-tenant-e2e-shared-a-5f1e04/e2e-rate-iso-a-64afed@ai-tenant-e2e-shared-a-5f1e04/rate-test-model-5f1e04","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5f1e04","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64afed","namespace":"ai-tenant-e2e-shared-a-5f1e04","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"50fc5c51-90c9-4dd1-b4f0-57706bbf2fa1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"50fc5c51-90c9-4dd1-b4f0-57706bbf2fa1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"98db6d84-7e3e-465a-b43d-e44407b2267c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:55424","PortSpecifier":{"PortValue":55424}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"98db6d84-7e3e-465a-b43d-e44407b2267c","method":"POST","path":"/ai-tenant-e2e-shared-b-28686a/rate-test-model-28686a/v1/completions","host":"e2e-shared-b-28686a.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"98db6d84-7e3e-465a-b43d-e44407b2267c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:55424","PortSpecifier":{"PortValue":55424}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783090225,"nanos":190222500},"http":{"id":"98db6d84-7e3e-465a-b43d-e44407b2267c","method":"POST","headers":{":authority":"e2e-shared-b-28686a.apps.72c53553-14bb-4f05-a07f-8fa024d471b6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-28686a/rate-test-model-28686a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"98db6d84-7e3e-465a-b43d-e44407b2267c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1XB0JohnLTM4ttVsm_gICCZ7wrAklsCN9SprXLT63TFaRzbRPziEoqD3E5w0q"}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"98db6d84-7e3e-465a-b43d-e44407b2267c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-28686a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1XB0JohnLTM4ttVsm_gICCZ7wrAklsCN9SprXLT63TFaRzbRPziEoqD3E5w0q\"}"}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"98db6d84-7e3e-465a-b43d-e44407b2267c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-28686a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9625db6a-0671-46ef-8e63-d6b5a3ed4285","keyName":"e2e-rate-b-64afed","subscription":"e2e-rate-iso-b-64afed","tenant":"e2e-shared-b-28686a","userId":"9625db6a-0671-46ef-8e63-d6b5a3ed4285","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"98db6d84-7e3e-465a-b43d-e44407b2267c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-28686a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-28686a/rate-test-model-28686a\",\"requestedSubscription\":\"e2e-rate-iso-b-64afed\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"98db6d84-7e3e-465a-b43d-e44407b2267c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-28686a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-28686a","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-64afed","namespace":"ai-tenant-e2e-shared-b-28686a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"98db6d84-7e3e-465a-b43d-e44407b2267c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98db6d84-7e3e-465a-b43d-e44407b2267c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98db6d84-7e3e-465a-b43d-e44407b2267c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98db6d84-7e3e-465a-b43d-e44407b2267c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-28686a/rate-test-model-28686a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98db6d84-7e3e-465a-b43d-e44407b2267c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98db6d84-7e3e-465a-b43d-e44407b2267c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98db6d84-7e3e-465a-b43d-e44407b2267c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-64afed"}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98db6d84-7e3e-465a-b43d-e44407b2267c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98db6d84-7e3e-465a-b43d-e44407b2267c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9625db6a-0671-46ef-8e63-d6b5a3ed4285","keyName":"e2e-rate-b-64afed","selected_subscription":"e2e-rate-iso-b-64afed","selected_subscription_key":"ai-tenant-e2e-shared-b-28686a/e2e-rate-iso-b-64afed@ai-tenant-e2e-shared-b-28686a/rate-test-model-28686a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-28686a","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-64afed","namespace":"ai-tenant-e2e-shared-b-28686a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"98db6d84-7e3e-465a-b43d-e44407b2267c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-03T14:50:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"98db6d84-7e3e-465a-b43d-e44407b2267c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-03T14:50:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/87aad659666129df930ae3da1392ff514a9e859b53d4699cd5c62279e607dfbb"}
{"level":"info","ts":"2026-07-03T14:50:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4597c544e325ad79b33b73db7dbc249f06348e877aff727e229453210130b14d"}
{"level":"info","ts":"2026-07-03T14:50:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/053727ff9bfc97d33969508ff3039b50a215303fd2ecadc2f94858f9009aa0fa"}
{"level":"info","ts":"2026-07-03T14:50:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3e178de997074fe2e6be8e9ccbd3240ba5cdd840f8d8635d8b91d3285f0a1afe"}
{"level":"info","ts":"2026-07-03T14:50:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ea71400b4948ca776489731482d56adc440d326f468ad9cfd3f92c4910a641e2"}
{"level":"info","ts":"2026-07-03T14:50:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6da687a9423cb1cd83f9369b18c567cc07f2740dc9f3cb687b027f113a78f8f8"}
{"level":"info","ts":"2026-07-03T14:50:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b31e033c2769b31b04fb6af32e382ca1c8ba8d9ffac1104d3bfdb4176a0586a7"}
{"level":"info","ts":"2026-07-03T14:50:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/771af810728e3343d423e7dd0e7f672e8091321060d5c93741f8d2b63a1dc2ca"}
{"level":"info","ts":"2026-07-03T14:50:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/18c77cbc043712a430b3ab046fb7a8c70038979271dc93731e061dd7135c0937"}
{"level":"info","ts":"2026-07-03T14:50:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fae6878d457b6289f8d706d2031988169fdd437c70955859c223174df0f3c979"}
{"level":"info","ts":"2026-07-03T14:50:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b5e25a53111a6a6306192c36e709e8fe981522c10ba51529dbe74dca96d436c6"}
{"level":"info","ts":"2026-07-03T14:50:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1da4a770c0278faeee21afbf1390ce8d6b36de8cd36d2619b950abf305036cc6"}
{"level":"info","ts":"2026-07-03T14:50:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6db2aadf746eb80c2bbd0e0030d907451b51db9d2506c1028c9ab972e6b0b245"}
{"level":"info","ts":"2026-07-03T14:50:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2b3d5ce24ab33eeea1b018d17fa24507338dc96f0fd2385383b8f4cacc9b2046"}
{"level":"info","ts":"2026-07-03T14:50:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cd4f243ffc7dbb58e04c6983ec796ab49558a11d0755bf22db2df66ec336c07a"}
{"level":"info","ts":"2026-07-03T14:50:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5b99b2c497c3817255fbcf023aaeeeddbece345da53b037e0ff53b9ed8331fbd"}
{"level":"info","ts":"2026-07-03T14:51:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0185a7089d7aa5db387ce8e5b1d4e6dafff3ed1df0afc5d209c9ece82d8ff4a2"}
{"level":"info","ts":"2026-07-03T14:51:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0fd8d72267f80a3490f09e2b7edd5614c945a877e3430a25f075206e96823ede"}
{"level":"info","ts":"2026-07-03T14:51:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ccf844f57fd8314eca4a040bd8ebc2be525ed88f246425d5ca2b8cb8dc10e0b5"}
{"level":"info","ts":"2026-07-03T14:51:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/15b54feaa3283b591d6954a4c2e498f308b468789829c0d93c654070e3e53c07"}
{"level":"info","ts":"2026-07-03T14:51:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0c98039502d78adfbda0e8012d4940b0ca3257544f8aa3d72e823c1b590eaece"}
{"level":"info","ts":"2026-07-03T14:51:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e6b2297f9471e2f5b885ee1a891990a3479ae3ae777d0c7a5114e9bf8281a7fb"}
{"level":"info","ts":"2026-07-03T14:51:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/203181f7301d734b850333610db2593513f38583d99cd3af768fb99984e85fbd"}
{"level":"info","ts":"2026-07-03T14:51:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d76cf2f0756dcc9cb91fbae467d60ce4402ac8feadbd9092e310afa799791a00"}